---
title: "Security digest: March 21, 2025"
url: https://erroneo.us/security/2025-03-21/
description: "March 21, 2025 vulnerability digest: 2 briefs (CrushFTP Auth Bypass CVE-2025-31161 Exploited in…); 2 critical advisories (PyPI, npm). What to patch and who…"
type: security-digest-day
section: "Security Digest"
date_published: 2025-03-21
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: March 21, 2025

2 editorial briefs and 2 critical advisories.

## Take stock

- Check exposure: CrushFTP Auth Bypass CVE-2025-31161 Exploited in the Wild . Anyone running an internet-facing CrushFTP 10 or 11 server, particularly without the DMZ proxy instance in front.
- Check exposure: Next.js Middleware Authorization Bypass (CVE-2025-29927) . Teams self-hosting Next.js 11.1.4 through 15.2.2 with next start or output: 'standalone' whose middleware enforces authentication, authorization, redirects or security headers.
- PyPI: 1 critical advisory ( InvokeAI ). Check with pip-audit (or: pip show <package>) .
- npm: 1 critical advisory ( next ). Check with npm audit (or: npm ls <package>) .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Check exposure** [CrushFTP Auth Bypass CVE-2025-31161 Exploited in the Wild](https://erroneo.us/security/briefs/crushftp-auth-bypass-cve-2025-31161/index.md): Fixed since March 2025 and widely exploited from early April; if you run CrushFTP, make sure you are on a current build (later CrushFTP flaws raised the minimum) and audit for backdoor admin accounts.
- **Check exposure** [Next.js Middleware Authorization Bypass (CVE-2025-29927)](https://erroneo.us/security/briefs/nextjs-middleware-bypass-cve-2025-29927/index.md): Patched since March 2025 and easy to fix; if you self-host Next.js and lean on middleware for auth, confirm you are on a fixed release and that the header is stripped at your edge.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [CVE-2024-12029](https://erroneo.us/security/cve/CVE-2024-12029/index.md) InvokeAI Deserialization of Untrusted Data vulnerability — PyPI InvokeAI >= 5.3.1, < 5.4.3rc2 → 5.4.3rc2
- [CVE-2025-29927](https://erroneo.us/security/cve/CVE-2025-29927/index.md) Authorization Bypass in Next.js Middleware — npm next >= 13.0.0, < 13.5.9 → 13.5.9; npm next >= 14.0.0, < 14.2.25 → 14.2.25; npm next >= 15.0.0, < 15.2.3 → 15.2.3

---
Source page: https://erroneo.us/security/2025-03-21/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt